Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.743exploits catalogados
39.318CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.394Exploit-DB 24.485GitHub PoC 16.212VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
24.485 exploits
Exploit-DB
OpenSource ERP 6.3.1. - SQL Injection
Nelson Open Source ERP v6.3.1 allows SQL Injection via the db/utils/query/data.xml query parameter.
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - DSSVC CheckFilePermission Arbitrary File Deletion
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (A
23RIESGO
abrir ↗Exploit-DB
BlogEngine 3.3 - XML External Entity Injection
BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.
28RIESGO
abrir ↗Exploit-DB
Microsoft Office SharePoint Server 2016 - Denial of Service (Metasploit)
A denial of service vulnerability exists when OData Library improperly handles web requests, aka "OData Denial of Servic
28RIESGO
abrir ↗Exploit-DB
ZTE MF65 BD_HDV6MF65V1.0.0B05 - Cross-Site Scripting
All versions up to V1.0.0B05 of ZTE MF65 and all versions up to V1.0.0B02 of ZTE MF65M1 are impacted by cross-site scrip
23RIESGO
abrir ↗Exploit-DB
Ajera Timesheets 9.10.16 - Deserialization of Untrusted Data
Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deserializ
28RIESGO
abrir ↗Exploit-DB
MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting
The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards pag
23RIESGO
abrir ↗Exploit-DB
LayerBB 1.1.1 - Persistent Cross-Site Scripting
LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).
23RIESGO
abrir ↗Exploit-DB
Roxy Fileman 1.4.5 - Unrestricted File Upload / Directory Traversal
Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.
60RIESGO
abrir ↗Exploit-DB
PLC Wireless Router GPN2.4P21-C-CN - Cross-Site Scripting
ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have XSS via the cgi-bin/webproc?getpage
23RIESGO
abrir ↗Exploit-DB
Huawei E5330 21.210.09.00.158 - Cross-Site Request Forgery (Send SMS)
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13S
23RIESGO
abrir ↗Exploit-DB
KioWare Server Version 4.9.6 - Weak Folder Permissions Privilege Escalation
KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting any
23RIESGO
abrir ↗Exploit-DB
Roxy Fileman 1.4.5 - Unrestricted File Upload / Directory Traversal
Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.
28RIESGO
abrir ↗Exploit-DB
Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (polkit Method)
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat
38RIESGO
abrir ↗Exploit-DB
Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (dbus Method)
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat
38RIESGO
abrir ↗Exploit-DB
Ayukov NFTP FTP Client 2.0 - Buffer Overflow
Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code.
50RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
WebKit JSC - 'JSArray::shiftCountWithArrayStorage' Out-of-Bounds Read/Write
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1,
28RIESGO
abrir ↗Exploit-DB
Frog CMS 0.9.5 - Cross-Site Scripting
Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
WebKit JSC - 'AbstractValue::set' Use-After-Free
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1,
23RIESGO
abrir ↗Exploit-DB
VMware Workstation/Player < 12.5.5 - Local Privilege Escalation
VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration fil
38RIESGO
abrir ↗Exploit-DB
Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x64) - 'AF_PACKET' Race Condition Privilege Escalation
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau
43RIESGO
abrir ↗Exploit-DB
Linux Kernel 4.8.0-34 < 4.8.0-45 (Ubuntu / Linux Mint) - Packet Socket Local Privilege Escalation
The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate cer
43RIESGO
abrir ↗Exploit-DB
Linux Kernel < 4.4.0/ < 4.8.0 (Ubuntu 14.04/16.04 / Linux Mint 17/18 / Zorin) - Local Privilege Escalation (KASLR / SMEP)
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE
43RIESGO
abrir ↗Exploit-DB
Craft CMS 3.0.25 - Cross-Site Scripting
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.
23RIESGO
abrir ↗Exploit-DB
bludit Pages Editor 3.0.0 - Arbitrary File Upload
bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages
35RIESGO
abrir ↗Exploit-DB
Adobe Flash ActiveX Plugin 28.0.0.137 - Remote Code Execution (PoC)
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful
93RIESGO
abrir ↗Exploit-DB
WSTMart 2.0.8 - Cross-Site Request Forgery (Add Admin)
WSTMart 2.0.7 has CSRF via the index.php/admin/staffs/add.html URI.
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Netatalk 3.1.12 - Authentication Bypass (PoC)
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking
70RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Netatalk 3.1.12 - Authentication Bypass
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking
70RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
VBScript - VbsErase Reference Leak Use-After-Free
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows
35RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.